Lucene search

[email protected]CVE-2019-3948

HistoryJul 29, 2019 - 10:15 p.m.

CVE-2019-3948

2019-07-2922:15:12

CWE-306

[email protected]

web.nvd.nist.gov

amcrest

dahua

ip camera

vulnerability

unauthenticated access

/videotalk

audio capture

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.6 High

AI Score

Confidence

High

0.074 Low

EPSS

Percentile

94.1%

JSON

The Amcrest IP2M-841B V2.520.AC00.18.R, Dahua IPC-XXBXX V2.622.0000000.9.R, Dahua IPC HX5X3X and HX4X3X V2.800.0000008.0.R, Dahua DH-IPC HX883X and DH-IPC-HX863X V2.622.0000000.7.R, Dahua DH-SD4XXXXX V2.623.0000000.7.R, Dahua DH-SD5XXXXX V2.623.0000000.1.R, Dahua DH-SD6XXXXX V2.640.0000000.2.R and V2.623.0000000.1.R, Dahua NVR5XX-4KS2 V3.216.0000006.0.R, Dahua NVR4XXX-4KS2 V3.216.0000006.0.R, and NVR2XXX-4KS2 do not require authentication to access the HTTP endpoint /videotalk. An unauthenticated, remote person can connect to this endpoint and potentionally listen to the audio of the capturing device.

Affected configurations

NVD

Node

amcrestip2m-841b_firmwareMatch2.520.ac00.18.r

AND

amcrestip2m-841bMatch-

Node

dahuadh-ipc-hx863xRange<2018-05-18

dahuadh-ipc-hx883xRange<2018-05-18

dahuadh-sd4xxxxxRange<2018-05-18

dahuadh-sd5xxxxxRange<2018-05-18

dahuadh-sd6xxxxxRange<2018-05-18

dahuaipc-hx4x3xRange<2018-05-18

dahuaipc-hx5x3xRange<2018-05-18

dahuaipc-xxbxxRange<2018-05-18

dahuanvr2xxx-4ks2Range<2018-05-18

dahuanvr4xxx-4ks2Range<2018-05-18

dahuanvr5xxx-4ks2Range<2018-05-18

CPENameOperatorVersion
amcrest:ip2m-841b_firmwareamcrest ip2m-841b firmwareeq2.520.ac00.18.r

CPE	Name	Operator	Version
amcrest:ip2m-841b_firmware	amcrest ip2m-841b firmware	eq	2.520.ac00.18.r

CNA Affected

[
  {
    "product": "Dahua IPC-XXBXX",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "V2.622.0000000.9.R"
      }
    ]
  },
  {
    "product": "Dahua IPC HX5X3X and HX4X3X",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "V2.800.0000008.0.R"
      }
    ]
  },
  {
    "product": "Dahua DH-IPC HX883X and DH-IPC-HX863X",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "V2.622.0000000.7.R"
      }
    ]
  },
  {
    "product": "Dahua DH-SD4XXXXX",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "V2.623.0000000.7.R"
      }
    ]
  },
  {
    "product": "Dahua DH-SD5XXXXX",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "V2.623.0000000.1.R"
      }
    ]
  },
  {
    "product": "Dahua DH-SD6XXXXX",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "V2.640.0000000.2.R and V2.623.0000000.1.R"
      }
    ]
  },
  {
    "product": "Dahua NVR5XX-4KS2",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "V3.216.0000006.0.R"
      }
    ]
  },
  {
    "product": "Dahua NVR4XXX-4KS2",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "V3.216.0000006.0.R and NVR2XXX-4KS2"
      }
    ]
  }
]